b3628770aaf2246a1fcedfae7e8b7523e962ca49340f6bb881562c0673a4a446

Analysis

max time kernel
122s
max time network
135s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MalwareDatabase-master/ddom.py
Size

10KB
MD5

2bb7a31b5f742d86dc3da75062721ca1
SHA1

56b13fb8ee798225754f9e5041344481ceb8d898
SHA256

efb2c2a1a35d64c72c38fe933c11035e3d8c3849a36ecb37cd10c903a4267ca6
SHA512

b362a589519def2b2ff167bc76e4268fcebf690e9c17fbf710055312eb9cf9f30bba0264767fa60f912f5368e1808ae0f1aecca2c109d039ac846a9fd6414bd6
SSDEEP

192:VkZKiQ5AAAAAKPcuGqUzua3/MO/fw+XlJqS+zZS2/Dccs9KT9JzdJC2LDawWL0m:VkZKiQ5AAAAAWcuGqUvkV+XlJqT5/Dcz

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2936	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2936	AcroRd32.exe
2936	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 388	756	cmd.exe	32
PID 756 wrote to memory of 388	756	cmd.exe	32
PID 756 wrote to memory of 388	756	cmd.exe	32
PID 388 wrote to memory of 2936	388	rundll32.exe	33
PID 388 wrote to memory of 2936	388	rundll32.exe	33
PID 388 wrote to memory of 2936	388	rundll32.exe	33
PID 388 wrote to memory of 2936	388	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MalwareDatabase-master\ddom.py
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MalwareDatabase-master\ddom.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MalwareDatabase-master\ddom.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
67f79ba2735a93e710bcdba6540fc694

SHA1
5332347d7ccc9ea19cab5d599a11467f06b2599b

SHA256
1b97835dea70cd5a375ca399fb9e4e61bc466f7342662252e06f1f9543dd365b

SHA512
40f01c1372a490528c00e906a3886ac0262ad2d8bc26670a5c408312248a6a0fddd98bd69f8ec48c5694d3634b202c8f2d71252807db892bfa2ffc586be6d1e8

Download Submit